What is TOTP?
TOTP is a time-based one-time password algorithm that derives a short-lived code from a shared secret and the current time.
English name, abbreviation and common aliases
- English name: Time-based One-Time Password
- Abbreviation: TOTP
- Common aliases: Authenticator code, Time-based OTP
How does TOTP work?
The authenticator and server calculate an HMAC-based value for the same time step, commonly 30 seconds. The server checks a small time window to allow clock drift and prevents replay.
A concrete example
An authenticator app and a service share a secret during setup. At login, both independently calculate the same six-digit code for the current 30-second interval.
TOTP vs. related concepts
TOTP does not require message delivery after enrollment. SMS verification sends a code over the telephone network, while OTP is the broader one-time-password category.
Use cases, benefits and risks
Typical uses include sign-up, account recovery, transaction confirmation and multi-factor authentication. The benefit is proof of control over a channel or secret. Risks include interception, number recycling, phishing, weak recovery flows and overreliance on a single factor.
How is TOTP related to DuoPlus?
An authorized user can install an authenticator app on a DuoPlus cloud phone to generate TOTP codes. TOTP is calculated offline from a shared secret and device time, so it does not depend on DuoPlus Cloud Number or SMS. Authenticator seeds, QR codes and recovery codes are sensitive credentials and should have restricted access and a separate secure backup.
Frequently asked questions
Can incorrect cloud-phone time break TOTP?
Yes. TOTP requires the device and server clocks to be reasonably synchronized. If codes repeatedly fail, check automatic time and time-zone settings before scanning the secret again.
What should I do before New Device or migrating the cloud phone?
Make sure the authenticator is securely migrated according to the service’s rules and store recovery codes separately. Keeping the only TOTP secret on a cloud phone that will be reset can permanently lock the account.
